EUVD-2026-57927
GHSA-pv8r-xmqx-g2r9
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent BLE vector with no authentication required; re-pairing downgrade is protocol-level and low-complexity; full C/I/A impact follows from LTK recovery enabling decryption and command injection.
Primary rating from Vendor (Silabs).
CVSS VectorVendor: Silabs
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.
AnalysisAI
Security level downgrade during Bluetooth Low Energy re-pairing in Silicon Labs WiseConnect exposes the Long Term Key (LTK) to practical brute-force attack by an adjacent unauthenticated attacker. Devices running WiseConnect 4.0.0 through 4.0.x and WiseConnect 2.0.0 through 2.13.x accept re-pairing negotiations at weaker security parameters than originally established, reducing LTK entropy and enabling offline key recovery. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be within BLE radio range of the target device (physically co-located, typically within 10-100 meters). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 8.8 reflects a technically sound assessment: adjacent network vector with no authentication or user interaction required, and full C/I/A impact upon LTK recovery. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker within BLE radio range of a vulnerable WiseConnect device jams or spoofs the existing bonded peer to force bond loss and initiate re-pairing, causing the device to accept new pairing parameters at a weaker security level than the original session. The attacker captures the re-pairing handshake, then brute-forces the lower-entropy LTK offline - feasible because the reduced key space makes exhaustive search tractable with modest computing resources. … |
| Remediation | The primary remediation is to upgrade WiseConnect 4.x deployments to version 4.1.0 or later, and WiseConnect 2.x deployments to version 2.14.0 or later; fix details are documented in the SISDK release notes at https://docs.silabs.com/sisdk-release-notes/latest/sisdk-wifi-release-notes/sisdk-wifible-ble-release-notes and the RS9116 release notes at https://docs.silabs.com/rs9116-wiseconnect/latest/wifibt-wc-release-notes/rs9116-ble-release-notes#bug-fixes, with the community advisory at https://community.silabs.com/068Vm00000x0yyH providing platform-specific guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all systems and devices running Silicon Labs WiseConnect to identify those on affected versions (2.0.0 through 2.13.x or 4.0.0 through 4.0.x). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wiseconnect
View allBLE encryption key downgrade in Silicon Labs WiseConnect allows adjacent, unauthenticated attackers to brute-force sessi
Bluetooth Low Energy re-pairing in Silicon Labs RS9116W and SiWx91x devices allows a nearby unauthenticated attacker to
BLE re-pairing attacks against Silicon Labs RS9116W and SiWx917 modules allow an adjacent unauthenticated attacker to sp
Bluetooth LE legacy pairing authentication in Silicon Labs RS9116W and SiWx917 wireless modules (WiseConnect SDK) can be
Information disclosure in Silicon Labs RS9116W and SiWx917 wireless modules running WiseConnect exposes potentially sens
Same weakness CWE-305 – Authentication Bypass by Primary Weakness
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today